Disclaimer: This guide is about Part X of the Child, Youth and Family Services Act, 2017, and its regulations.
The guide should not be relied on as a substitute for the legislation itself, or legal advice. It is not an official legal interpretation of Part X and does not bind the Office of the Information and Privacy Commissioner of Ontario (IPC).
The IPC gratefully acknowledges the contributions of representatives from the following organizations, who assisted with the preparation of this guide:
  • Association of Native Child and Family Service Agencies of Ontario
  • Ministry of Children, Community and Social Services
  • Ontario Association of Children’s Aid Societies
  • Ontario Association of Residences Treating Youth
  • Ontario Residential Care Association

Part X of the Child, Youth and Family Services Act sets the rules that service providers must follow to protect privacy and enable access to personal information, effective January 1, 2020.

If you are a service provider seeking to understand your obligations under Part X, this guide is for you. It provides an overview of the core rules for collecting, using, disclosing, safeguarding and managing personal information, consent and capacity, and access to and correction of personal information. It also explains how these rules are enforced. Additional Part X requirements, such as those related to research and prescribed entities, are addressed only at a high level.

This guide is not a substitute for legal advice. If you are unsure of how to apply Part X in a given situation, you should contact the person in your organization responsible for ensuring compliance with Part X, or a lawyer.

If you have general questions about Part X, you can contact the Ministry of Children, Community and Social Services or the Office of the Information and Privacy Commissioner of Ontario (IPC).

You may find it helpful to read this guide with the CYFSA itself. If so, the guide’s endnotes point you to the relevant sections of the legislation. You may also want to consult the definitions section. In addition to summarizing the requirements of Part X, this guide also presents some best practices and practical examples.

About the IPC

The IPC provides oversight of Ontario’s access and privacy laws, including Part X. These laws establish the rules for how Ontario’s public institutions, health information custodians and service providers may collect, use, and disclose personal information.

As part of our mandate, we investigate privacy complaints related to personal information and ensure compliance with Ontario’s access and privacy laws. Any person can file a complaint with the IPC about anyone who has or is about to break the rules of Part X. More information about our complaints process.

Part of our mandate at the IPC is to provide information and education. We are available to consult with service providers to support their compliance with Part X.


Help us improve our website. Was this page helpful?
When information is not found


  • You will not receive a direct reply. For further enquiries, please contact us at @email
  • Do not include any personal information, such as your name, social insurance number (SIN), home or business address, any case or files numbers or any personal health information.
  • For more information about this tool, please see our Privacy Policy.